Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@HackerOne MCP Server Show me the in-scope assets and scope exclusions for uber."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Hey there! 👋 Welcome to the HackerOne MCP Server.
This tool seamlessly connects your favorite AI assistants (Claude Code, Claude Desktop, Cursor, Windsurf) directly to your HackerOne account.
Whether you want to search your past reports, manage draft report intents, check program scope rules & exclusions, analyze bounty payouts, draft vulnerability write-ups, or reply to triagers — your AI can now help you do it all right from your chat window! 🚀
Head over to HackerOne > Settings > API Token and generate your token.
git clone https://github.com/Sicks3c/hackerone-mcp-server.git
cd hackerone-mcp-server
npm install
npm run buildnpx -y @smithery/cli mcp add hackerone-mcp-serverclaude mcp add hackerone \
-e H1_USERNAME="your-h1-username" \
-e H1_API_TOKEN="your-h1-api-token" \
-s user \
-- node /path/to/hackerone-mcp-server/dist/index.jsAdd this to your claude_desktop_config.json:
{
"mcpServers": {
"hackerone": {
"command": "node",
"args": ["/path/to/hackerone-mcp-server/dist/index.js"],
"env": {
"H1_USERNAME": "your-h1-username",
"H1_API_TOKEN": "your-h1-api-token"
}
}
}
}In your editor's MCP Settings, add a new server:
Type: stdio
Command: node /path/to/hackerone-mcp-server/dist/index.js
Env: Set H1_USERNAME and H1_API_TOKEN
Related MCP server: h1-brain
Here are a few fun prompts to try out:
🔍 Recon & Scope: "Show me the in-scope assets and scope exclusions for uber. What are their response times and accepted vulnerability types?"
📝 Report Intents (Drafts): "Create a new report intent draft for program gitlab titled 'XSS in search endpoint'. Let's refine the write-up before submitting."
💬 Triage Assistance: "The triager on report #123456 requested an updated PoC. Help me write a friendly technical response."
💰 Check Stats & Payouts: "How much unpaid balance do I have on HackerOne right now, and show my payout history via PayPal?"
📊 Analyze Patterns: "Analyze my report history — what severity gets resolved the fastest for me?"
🔎 Hacktivity Research: "Search disclosed reports on github for IDOR vulnerabilities to see what they usually pay."
Category | Tool | What it does |
Reports |
| Search your reports by keyword, program, severity, or state |
| View full report details (CVSS score, bounty, attachments) | |
| View report details along with full triage conversation | |
| View timeline of comments, bounties, and status changes | |
| Submit a brand new report to a program | |
| Post a comment or reply to a triager | |
| Withdraw or close a report | |
| Build a clean Markdown template for your report write-up | |
Report Intents (Drafts) |
| List all draft report intents and AI processing job statuses |
| Get details of a specific draft report intent | |
| Create a new draft report intent | |
| Update draft report intent title or write-up | |
| Delete a draft report intent | |
| Finalize and submit a draft intent as an official report | |
| List attachments for a draft report intent | |
| Delete an attachment from a draft report intent | |
Programs |
| Discover & rank the best programs by fast payouts, bounties, or open scope |
| List all bug bounty programs you have access to | |
| Check program policy, response metrics, and average pay times | |
| List all in-scope assets for a target program | |
| List report categories specifically excluded from rewards | |
| List accepted weakness/CWE categories for a program | |
Profile & Financials |
| Check your reputation score, signal, impact, and rank |
| See your bounty earnings history | |
| Check completed payouts history (PayPal, Wire, status) | |
| Check your current unpaid bounty balance | |
| Get stats on your report severities, states, and top programs | |
Hacktivity |
| Search publicly disclosed hacktivity reports for research |
Your AI can instantly look up these hackerone:// URIs:
👤 hackerone://profile — Your live reputation, signal, impact, and rank.
💵 hackerone://balance — Your unpaid balance.
📈 hackerone://earnings/recent — Your latest bounty payouts.
📋 hackerone://reports/recent — Your 10 latest submitted reports.
🔥 hackerone://hacktivity/trending — Top upvoted public reports on Hacktivity.
find-best-bounty-program: Automated strategy prompt to find & rank the highest-paying, fast-response target programs.
draft-vulnerability-report: Step-by-step guide to draft a top-tier report.
triage-response-assistant: Craft polite, effective replies to triagers.
analyze-program-scope: Break down a program's assets to find high-yield targets.
summarize-hunting-profile: Create a neat summary dashboard of your research stats.
Setting | Required? | Default | Description |
| Yes | — | Your HackerOne API Username |
| Yes | — | Your HackerOne API Token |
| No |
| Base API URL |
| No |
| Response caching speed booster |
| No |
| Verbosity ( |
100% Local: Runs completely on your local machine using stdio transport.
Your Credentials Stay Yours: Your API keys are kept strictly in your local environment variables and never sent anywhere except directly to HackerOne's official API.
MIT License — Feel free to use, modify, and share! Happy hunting! 🎯
Add a comment to an existing HackerOne report. Use this to respond to triage questions or provide additional information.
Inputs: message (required), report_id (required), internal.
Fetch your recent reports and analyze patterns: most common vulnerability types, severity distribution, resolution rates, and programs. Useful for understanding your hunting profile.
Inputs: page_size.
Withdraw/close one of your own HackerOne reports. Sends a close request with an optional message.
Inputs: report_id (required), message.
Create a new draft report intent before submitting as a report.
Inputs: title, description, program_handle.
Delete a draft report intent.
Inputs: report_intent_id (required).
Delete an attachment from a draft report intent.
Inputs: attachment_id (required), report_intent_id (required).
Discover and filter the best active bug bounty programs matching your criteria: bounty offers, fast payments, open submission, open scope, or keywords.
Inputs: query, max_results, open_scope_only, fast_payments_only, +2 more.
Generate a structured Markdown template for drafting a vulnerability report. Helps format Summary, Steps to Reproduce, Impact, and Remediation.
Inputs: title (required), impact (required), summary (required), target_asset (required), +3 more.
Get your current unpaid bounty balance on HackerOne.
Inputs: no named parameters.
Get your bounty earnings history. Shows amounts, currency, dates, and which programs paid out.
Inputs: page_size.
Get your HackerOne hacker profile: reputation, signal, impact, rank, and account info.
Inputs: no named parameters.
Get your payout history showing completed payout transactions, payment providers (e.g. PayPal, Wire), status, and dates.
Inputs: page_size.
Get detailed info about a single program: policy, response times, metrics, bounty splitting, and submission state.
Inputs: program_handle (required).
Get the in-scope assets for a bug bounty program. Auto-paginates to return all scope items. Returns asset types, identifiers, bounty eligibility, and severity caps.
Inputs: program_handle (required), page_size.
Get the accepted vulnerability/weakness types for a program. Auto-paginates. Helps frame reports using the right CWE categories the program cares about.
Inputs: program_handle (required), page_size.
Get the full details of a specific HackerOne report by ID. Returns title, vulnerability details, impact, severity, full CVSS vector/score, bounty amounts, attachments, timestamps, and program info.
Inputs: report_id (required).
Get the activity timeline of a report: comments, state changes, bounty awards, and triage responses.
Inputs: report_id (required), page_size.
Get details of a specific draft report intent by ID.
Inputs: report_intent_id (required).
List all attachments associated with a draft report intent.
Inputs: report_intent_id (required).
List all draft report intents and AI assistant processing job statuses.
Inputs: no named parameters.
Get a report with its full triage conversation. Useful for understanding what questions triage asked, how you responded, and what led to resolution. Great for learning what works.
Inputs: report_id (required).
Get report categories that are specifically excluded from rewards for a program.
Inputs: program_handle (required).
List bug bounty programs you have access to on HackerOne. Auto-paginates to return all programs.
Inputs: page_size.
Search publicly disclosed HackerOne reports (hacktivity). Useful for learning what gets paid, finding prior art, and understanding what a program considers valid.
Inputs: query, program, page_size.
Search and list your HackerOne reports. Filter by keyword, program, severity, or state. Great for finding past reports to reference when drafting new ones.
Inputs: sort, query, state, program, +3 more.
Submit a new vulnerability report to a HackerOne program. Returns the new report ID and URL. Use get_program_scope and get_program_weaknesses first to get the right scope/weakness IDs.
Inputs: title (required), program_handle (required), vulnerability_information (required), impact, +3 more.
Finalize and submit a draft report intent as an official vulnerability report.
Inputs: report_intent_id (required).
Update title or description of a draft report intent.
Inputs: report_intent_id (required), title, description.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 28 tools
Each tool targets a distinct aspect of the HackerOne platform: draft intents, final reports, programs, profile/earnings, and analysis. Even within reports, tools differentiate by detail level (basic, conversation, activities, search) without overlap.
All tools follow a consistent verb_noun pattern in snake_case (e.g., get_report_intent, create_report_intent, submit_report). The naming is predictable and descriptive, with no mixing of styles.
28 tools cover the full hacker workflow: draft lifecycle, report management, program research, and earnings. While slightly above average, each tool serves a unique purpose and the set is well-scoped.
The tool surface is remarkably complete for a hacker's needs: CRUD for report intents, full report interaction (submit, close, comment, search, activities), program exploration (scope, weaknesses, exclusions), and financial tracking (earnings, payouts, balance). Only minor optional features missing (e.g., editing submitted reports).
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Connects AI assistants to TrackingTime for querying time entries, projects, tasks, customers, and team data using natural language.
